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Abstract —In this paper, we propose a transmission scheme 
that achieves information theoretic security, without making 
assumptions on the eavesdropper’s channel. This is achieved hy 
a transmitter that deliberately introduces synchronization errors 
(insertions and/or deletions) based on a shared source of ran¬ 
domness. The intended receiver, having access to the same shared 
source of randomness as the transmitter, can resynchronize the 
received sequence. On the other hand, the eavesdropper’s channel 
remains a synchronization error channel. We prove a secrecy 
capacity theorem, provide a lower bound on the secrecy capacity, 
and propose numerical methods to evaluate it. 

I. Introduction 

With the appearance of wireless communications in the 
smallest of devices, communicating securely has become of 
paramount interest. We see an abundance of small devices 
with limited computing capability having access to potentially 
sensitive data. In addition to limited power and computational 
capability, another limitation that these devices have in com¬ 
mon is that they transmit over noisy channels. They all require 
error correction codes and specialized processors for reliable 
communications. A natural question arises, can we combine 
error correction codes and security? 

Wyner’s seminal paper HI proved it was possible to com¬ 
municate securely using wiretap codes, assuming the compos¬ 
ite channels were discrete and memoryless. Csiszar and Korner 
a generalized Wyner’s results to broadcast channels, where 
the unintended user does not neccesarily listen to the output 
of the main channel through a noisier channel. Hayashi El 
further generalized the preceeding results to arbitrary channels 
with finite output alphabet. Hayashi’s results were based upon 
using the information spectrum approach originating with Han 
and Verdu H. His results were particularly interesting since 
he included non-asymptotic results on secrecy capacity. Bloch 
and Laneman Q built upon Csiszar and Hayashi’s work in 
using channel resolvability as a basis for stronger secrecy 
results based on variational distance and hold for the most 
general of channels, e.g., arbitrary alphabets, memory, etc... 
Specifically, the system we present in this paper has memory, 
and a countably infinite output alphabet. 

The main obstacle to achieving secrecy through wiretap 
codes over wiretap (or similar) channels m, a, a is 
that the secrecy proof hinges on knowing, and guaranteeing 
the eavesdropper’s channel characteristics. In practice, the 
eavesdropper is typically an adversary and will not reveal her 
channel characteristics. Eor this reason, we employ a strategy 
in which we assume that both the intended user and the eaves¬ 
dropper receive (noise-free|^ the same symbols transmitted 

* In practice, this can be guaranteed, even over noisy channels, using error- 
correcting codes to achieve error-free transmission of information. 



Fig. 1. Synchronization Error Based Secrecy System 

by the transmitter (see Eig. 1). Instead of transmitting the 
codeword A”, the transmitter uses a secret shared source of 
randomness to randomly inject synchronization errors into the 
transmitted sequence. The intended receiver has access to the 
shared source of randomness and can thus resynchronize the 
received sequence, although not necessarily recover A". The 
eavesdropper, on the other hand, does not have access to the 
shared source of randomnes^ and is thus forced to attempt 
to decode the transmitted codeword. Under this constructed 
scenario, as we show in this paper, the Bloch-Laneman secrecy 
results a hold, and we therefore can communicate securely. 

This method is similar to the one in [|6], but instead of 
injecting additive errors, the transmitter injects synchronization 
errors, which has the following advantageous features. 

• Synchronization error channels are cryptographically 
favorable 3 to additive noise channels. 

• We do not make unverifiable physical channel assump¬ 
tions, for either the main or eavesdropper channel. 

• Inclusion of wiretap codes has low overhead because 
systems already use error correction codes. 

• Assuming a secret shared source of randomness, we 
are guaranteed a stronger version of secrecy then 
Wyner HI based on variational distance. 

Of course, these advantages must be traded off with some 
undesirable properties, such as, 

• We communicate at a different rate compared to 
conventional cryptographic systems, where the length 
of the plaintext and ciphertext are typically equal. 

^ For future considerations, we would like to replace the secret shared source 
of randomness with finite length keys drawn from a finite key space. 

^ Knowledge of the plaintext, does not guarantee an exact solution for the 
con'esponding key. 
























• We must construct resolvability codes for channels 
with synchronization errors. 

• In practice, we will require a secret preshared key in 
place of a secret shared source of randomness. 

A. Outline 

In Section II, we present our transmission scheme, and 
an equivalent wiretap channel based on synchronization errors 
with insertions and deletions. We then apply Bloch and Lane- 
man Is) to lower bound the secrecy capacity in Section III. 

In Section IV, we present hidden Markov techniques that 
allow us to estimate and bound the corresponding information 
rates. Due to the inherent difficulty of computing such rates 
in closed form for synchronization error channels, e.g., inser¬ 
tion/deletion channels, in this paper we also reveal a reduced 
state technique to lower bound the secrecy capacity. The lower 
bounding technique is constructive in the sense that it reveals 
the source distribution that achieves the bound. Finally, in 
Section V, we plot lower bounds for the secrecy capacity of 
the erasure/deletion, and insertion wiretap channels. 

B. Notation 


insertions and deletions with respective probabilities i and d. 
Let Zfc be the transmitter output drawn from the alphabet Z, 
where Z = X. The symbols are drawn using the shared 
source of randomness, R, as in algorithm 1. 

Data: R, Xi , ^2^.._ 

Result: Transmit Zi, Z 2 ■ ■ ■ 
while Xk at input do 

using R generate a geometric random variable 
G {0,1,... } with probability (1 — i); 
generate Nk Bernoulli(|)random variables, 

Bi,B2, ..., B^i^ ; 

using R generate a Bernoulli(d) random variable 
Dk; 

if Dfc == 1 then 

Zk = B,\\B2\\...\\Br,,- 

else 

Zk = Xk\\B4B2\\...\\BNZ, 

end 

Transmit Zk 

end 

Algorithm 1: Transmission Scheme 


An alphabet of symbols is denoted by a calligraphic letter, 
say X. Given two elements a,b G X, we denote their con¬ 
catenation by a\\b = ab. We denote the length zero word, by 
9, where a\\9 = 0|]a = a. An alphabet X does not necessarily 
contain 0. An n-fold Cartesian product of X is denoted by A". 
The alphabet obtained by the n-fold concatenation of symbols 
from X is denoted by and by definition = {9}. 

Observe if X = {a, b}, then X^'^'> = { aa,ab,ba,bb}. Given 
a base alphabet, X, and xi,X 2 , ■ ■ ■ ,Xn G X, we define the 
length of y = a;i||a; 2 || . •. ||x„ = X 1 X 2 ■ ■ • as 

L{y) = min{k\k G {0,1,. •. } such that y G (1) 

Given an alphabet X, we form X as the alphabet that consists 
of all finite-length concatenations of symbols from X, i.e., 

X = U X^^K Note, by construction X^ = A, for n > 1. 

Random variables are denoted by upper-case letters, (X), 
and their realizations by lower case letters {x). If k denotes dis¬ 
crete time, then Xk denotes a random variable at time k drawn 
from the alphabet X. Likewise, is assumed to be drawn 
from X. A sequence of random variables Xi, X 2 ,..., X„ is 
denoted by X”, and we have X" G X”. A concatenation 
of symbols Xi||X 2 || ... ||X„ = X 1 X 2 ... X„ is denoted by 
X^”), and we have X*^"^ G Given two random variables, 

X and Y, the information-spectrum is a random variable, 
denoted by I{X\Y). The expected value of I{X]Y) will 
be denoted as I(X;y) = E[/(X;X)]. Similarly, H{X) , 
a random variable, denotes the entropy-spectrum, and IHI(X) 
denotes the expected value. We denote the binary entropy 
function as follow^ h{x) = —xlog(a;) — (1 — x) log(l — x). 

IT Transmission Wiretap Model 
A. Transmission Scheme 


Since the intended receiver has access to the shared source 
of randomness, it can generate Xi, X 2 ,... , and Di, D 2 , ■. ■ 
Therefore it can create a sequence, Yi, ¥ 2 , • ■ • , by removing 
inserted symbols and substituting all deletions by erasures 
(denoted by e), i.e, the alphabet for Yfe is 3^ = {e} U X. 


Lemma R.l. E 



■ ( 1-0 


Example 1. Insertions and Deletions Let Z denote the 
sequence of symbols z generated by the transmitter after pro¬ 
cessing the first n input symbols Xi,X 2 , ■ ■ ■, Xn- For example, 
if (xi,X 2 ,X 3 ,X 4 ) = (0,1,1,0) and the transmitter decides to 
a) transmit xi and insert symbols 1,1, b) transmit X 2 without 
any insertions, c) delete X 3 , and d) transmit Xi and insert a 
symbol 0 (see Fig. 3). We have that = 011, = 0111, 

^(3) ^ 0111, andz^'^^ — 011100. Thus Alice transmits 011100. 
After resynchronization. Bob has (?/i, 1 / 2 , 2/3,2/4) = (0, l,e, 0). 


x"^ = 

(0,1,1,0) 

Xi 

X2 

X3 

X4 

= 

(0,1, e,0) 

0 

1 

1 

0 

^( 4 ) = 

011100 

on 

1 

X 

00 

zi,Z2,...,Ze = 

0,1,1,1,0,0 

on 

1 


00 


Eig. 2. Example 1 

B. Equivalent Wiretap Channel Model 

An equivalent wiretap channel model, in the terms of Bloch 
and Laneman 0, consists of the main channel being an erasure 
channel, and the wiretap channel being an insertion channel 
followed by an e-deletion channel. We define an e-deletion 
channel as a channel that deletes the erasure symbols, e. In 
particular, note a deletion channel is equivalent to an erasure 
channel followed by an e-deletion channel. 


Let Xfe be the channel input drawn from the finite alphabet, 
X = {0,1} (see Fig. 1). Our synchronization eiTor channel has 

“^Without loss of generality, we will assume all logarithms are base 2. 


III. Secrecy Capacity 

A main strength of Bloch’s and Laneman’s proof 0 of 
secrecy using information spectra, and channel resolvability 
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Fig. 3. Equivalent Degraded Wiretap Insertion/Deletion Model 


is the generality of their proof. In particular their notation 
uses Z for channel output, i.e., the output is synchronized 
with the channel input. Similarly to Han jO) p. 100, we claim 
that the results a apply to more general channels, e.g., the 
synchronization error wiretap model with output . 

Theorem III.l. (Bloch-Laneman Secrecy Capacity)/!^ The 
secrecy capacity, Cs, of the synchronization error wiretap 
model for secrecy metric S 2 is, 


Cs 


sup 


p-limmf-/(l/”;r") 

n—foo 

-p-limsup-/(V";^^”^) 

n—foo ^ 


( 2 ) 


where the process satisfies, 

\ln&Z+. 


Proof: The proof in is written for channels in which 
= z”, and uses two corollaries in Pinsker 47^ . Note 
that the two Pinsker lHW corollaries hold for synchronization 
error channels if we use instead of . Similarly, Bloch 
and Laneman ’s proof that, 3^4, for secrecy metrics holds. 
The remainder of their proof relies on results in channel 
resolvability from Plan which hold for channels with 
synchronization errors. ■ 

Corollary III.2. (Lower Bound for the Secrecy Capacity of the 
Insertion/Deletion Wiretap Channel Model) Let M. represent 
the set of all homogeneous Markov chains defined on the 
alphabet X. Then 


Cs > max lim — 
{X"}eM n^oo n 




(3) 


Proof: In our channel model we have assumed the wiretap 
channel is a degraded version of the main channel. Thus the 
supremum <0 is attained for V" = X". 

If X" is a homogeneous Markov process, the limit I = 
lim„_j,oo ) exists and is finite (see general proof 

in m but without sup in equation 2.7). Furthermore, as in 

p 17-19, the two sequences, X" and satisfy. 


lim P 

n—foo 


nl 




= 0 


(4) 


This is obtained in a similar fashion as in Dobrushin but 
again without the sup in eq. 2.7 ofm- It follows that, 

p-limsup-/(X";Z^”^) = lim = / 

n —^00 ^ ^ >00 Tl 

Observe the main channel is a discrete memoryless channel. 
Furthermore, given a stationary and ergodic input process, the 
output process is clearly stationary and ergodic. Thus, 

p-liminf-/(X";y") = lim -I(X”;r"). (5) 

n —yoo ^ ^ y<yo fi 

Finally, the inequality in Q follows because we restricted the 
input to homogeneous Markov processes. ■ 


Our intent in looking at the combined insertion/deletion 
channel, is to balance the output. We would like the ability 
to satisfy power requirements of the transmitter or receiver by 
altering the deletion and insertion probabilities. We shall now 
look at two contrasting cases, namely i = 0 and d = 0. 


1) Insertion Wiretap Channel: The d = 0 scenario is attrac¬ 
tive if the receiver has power (and computational) restrictions. 
We see that once in sync with the transmitter, the receiver 
is only required to demodulate bits declared as non-insertion 
bits by the shared random source, i.e., X" = V”. Thus the 
decoder is easy to implement on a low power device. The 
secrecy capacity, which we denote with Csi, is bounded as 


Csi > lim - 

n—foc) Tl . 

= lim — 

n—>-oo Tl - 


H(X") - -f 


(6) 

(7) 


where X” is an arbitrary Markov process. 


2) Deletion/Erasure Wiretap Channel: For the dele¬ 
tion/erasure wiretap model we have i = 0. This is the dual case 
to the insertion wiretap channel in the sense that the deletion 
of bits is relatively easy to implement at the transmitter. The 
main channel is now a discrete memoryless erasure channel 
for which there are well known codes, yet the receiver still 
requires some computational power to decode. This is a good 
choice if the transmitter is power limited (because it transmits 
fewer bits) but the receiver has ample power/computational 
resources. The secrecy capacity for this model, denoted by 
Csdi is now bounded as 


Csd > lim - 

n—foo Tl . 

= lim — 

n—>-oo Tl - 




( 8 ) 


H(y”) - n ■ h(d) - -f H(Z''‘'|X”) 


?(”)i 


where X” is an arbitrary Markov process. 


IV. Numerically Bounding Cs 

In this section we construct numerical techniques to lower 
bound Csi and Csd of the insertion and deletion eavesdropper’s 
channels given in the previous section, respectively. We shall 
assume the input process X" is an M-th order binary Markov 
process, i.e., X = {0,1}, whose 2 Mx2M 

transition probability 

matrix is P. The output of the eavesdropper’s channel is 
G Z = X. The main channel (X” ^ X") is a 
memoryless erasure channel, and X" G V" = {£,0,1}". 


> 0 





























A. Computing lim i]HI(X") 

Being Markov, X" has a closed form entropy rate Q. 


B. Computing lim i]HI(y"’) 

Since X" is a Markov Process, X" is a hidden Markov 
process obtained by passing X" through an erasure channel 
with erasure probability d. The entropy rate of X" can be 
evaluated using trellis-based Monte Carlo techniques mi. 


C. Computing lim 

Using Lemma II. 1 we have 


lim 

n—>-(x> Tl 


1 — d di 
1 — i 


lim 

fc—>-oo k 


(9) 


where is the sequence of symbols at the out¬ 
put of the eavesdropper’s channel. [Note, G = 

{0,1}*’, whereas S Z.] Next, we notice that the sequence 
is itself a hidden Markov process with an underlying 
Markov state sequence whose transition probability matrix 
is Q (explicitly given further down). That is. 


k 

Pr{z'"\sQ,s'") = Pr(Zm|Sm_i,Sm)Q(Sm-l,Sm) (10) 

m —1 


where Q(sm-i, Sm) are entries in Q. The state Sm is described 
as a binary string. If X^ is a Markov source of order M, then 
Sm is a binary string of length M. We denote by l{sm) the 
last (i.e. the M-th) binary digit of Sm- With this notation, we 
can fully describe the hidden Markov process Z^ as follows. 

1) Insertion channel: We have. 


Q = Q, = (1-i)P-Pil , and (11) 


Pt’{^Zm\t^7n—l^ ^m) — 
ij2 


Q(s„_i,s„ 
1 - 


^11 


Q(Sm-l,Sm) 


( 12 ) 

if tim—l — tSm and Zm ^ l{Sm) 
if ^m—l — tSm and Zm — l{Sm^ 

for all other valid pairs 


2 ) Deletion channel: We have, 

Q = Qrf = (1-d) [I-dP]”^P , and (13) 


Pr{Zm\Sm-l, Sm) 


1 if — ^{Sm) 
0 if ^ ^(Sm) 


(14) 


Since is hidden Markov, its information rate is computable 
using trellis-based Monte-Carlo techniques mu. 


D. Bounding lim 

1) Insertion Wiretap Channel: For the insertion channel, 
there are finitely many possible states for each received Zm, 
i.e., (fc + 1) possible states at time k (with regards to the 
receiver). For this paper we did not apply reduced state 
techniques, which is feasible for k « 10®. 


2) Deletion Wiretap Channel: For the deletion channel, we 
do not have a method to compute the conditional entropy 
rate lim 




so we resort to a reduced-state 


technique to lower bound the conditional entropy rate. For this 
purpose, we first need to formulate an appropriate trellis (with 
possibly countably infinite number of states per trellis section), 
then we apply an appropriate reduced-state technique to reduce 
the number of states per trellis section to a finite number and 
guarantee the lower bound on the conditional entropy rate. 


Prob/zi Prob/z2 

Oo Oi 02 



Fig. 4. Conditional Entropy Rate Trellis for the Deletion Channel 



Fig. 5. Conditional Entropy Rate Trellis for the Insertion Channel 


Because of the spatial constraints, we do not fully describe 
the method for reducing the states, but refer the reader to 
lIT^ for general reduced-state techniques for upper bounding 
entropy rates. The trellises constructed for computing the con¬ 
ditional entropy rate, lim -H for the deletion 

and insertion channels have the form as in Fig. and Fig. 













respectively. Note that the trellises are drawn/constructed only 
after a realization a:i, a; 2 ,... becomes available. 

E. Optimization of Markov Sources 

Any Markov source will result in a lower bound for Cgi 
and Csd- The best lower bound is obtained by maximizing the 
bound for varying Markov orders and Markov chain parameter 
P. This optimization can be done by a generalized Blahut- 
Arimoto algorithm ifTSl lfT4l adapted to wiretap channels ifTSll . 

V. Numerical Results 

In this paper, we present only numerical results (see Fig.[^ 
for Markov processes of order M = 1, thereby we do not resort 
to Blahut-Arimoto-type optimizations because an exhaustive 
search optimization is feasible for low-order Markov processes. 
For both the insertion and deletion channel we averaged 100 
simulations that were run on a trellis of length 10^. 

We see that although limi_j.i Csi = 1, in our transmission 
scheme this is of little help since as i 1 , we are unable to 
transmit to the intended user. Thus we must also look at the 
effective transmission rate. Re, which we define as, 



Observe, for our system we have Re = ^nd for 

i = 1 and d = 0, Re = Thus even though with regards 
to our equivalent wiretap channel model, we have Csi = 1, 
our implementation has Re = 0, and we can therefore not 
communicate with the intended user. 



Fig. 6. Secrecy Capacity (Lower Bound) vs Deletion/Insertion Probability 
for first order Markov (FOM) inputs 

VI. Conclusion 

We have presented a secrecy system based on synchroniza¬ 
tion errors, and provided techniques to lower bound the secrecy 
capacity. Furthermore, we have evaluated these bounds (using 
first order Markov input) for two important instantiations of 
the model. The proposed system is a complimentary example 
to the one time pad lEi m, in the sense that it is a method 
to use a shared source of randomness and achieve information 
theoretic security, yet it is not a stream cipher. The method has 
several advantages over a one time pad, e.g., the shared source 


of randomness is not uniquely determined given ciphertext and 
plaintext. 

The transmission scheme also has advantages with regards 
to system design. We have the ability to choose insertion 
and deletion probabilities to satisfy receiver, and transmitter 
requirements. In particular, we see in a system with powerful 
base stations, and lightweight distributed sensors, the base 
stations can transmit based on(i = 0<i<l and the 
lightweight sensors can transmit based oni = 0<(i<l. 
Thus the lightweight sensors transmit less, and decrypt easier, 
while the base stations can transmit more, and decode using 
computationally intensive error correction decoders. 
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